So I went to Hostgator to install another blog...

So what? They both get the job done, no?

Things are always changing in this industry.

Don't know ... but "one-click installations" for WordPress (if we're talking about WordPress?) are the least secure way to do it. Almost all the people whose WordPress blogs at "big-name hosts" like HostGator get randomly or maliciously hacked have installed it as a one-click operation from their cPanel ...

.

I've used Fantastico and Quick Install but Softaculous is the new kid on the block with 335 scripts currently...

Softaculous

And yeah, I do many manual installs as well.

Cheers

-don

That's not surprising, HostGator was one of the last major hosts using Fantastico. It's been years since their last major update and there's a lot better alternatives like Softaculous out there.

Tim,

Consider it a blessing. Fantastico was an awful setup. It basically installed Wordpress with known vulnerabilities. It was a hacker's delight.

Manual installs are the best way to go, and they are super easy. You can do one in less than 10 minutes once you get the hang of it.

Quick Install is pretty much the same thing.

Its juts as simple to use and I haven't had fantastico in my c panel for 6 months now.

I had the same surprise this morning. No warning. A list of blog installs nicely laid out in Fantastico gone too, and not imported into QuickInstall. A bit of an annoyance.

But not as annoying as the reason I was checking my sites. Apparently, HostGator did not appreciate me having more than 1 million files on a shared hosting account and a few had to be deleted or moved.

The advertising of "unlimited disk space" just isn't true. You get "unlimited disk space" but using "unlimited disk space" is not acceptable.

.

But what? They will both get the job done, no?

I just installed wordpress for the first time and used QuickInstall. It seemed to go fine, I received the email with my admin link, but when I click on the link to my wp admin dashboard, it says "Not found. The requested URL /wp-admin was not found on this server.'

wtf man

Dan,

I'm mostly talking about Fantastico. Believe it or not, there are still a ton of hosts using Fantastico. Take it from someone that has over 125 hosting accounts. I see it all the time. Not everyone is aware of the security problems with Fantastico. In fact, I would venture to guess that most people are not. The OP was using it up until yesterday.

Softaculous has gotten much better in the past year, if someone takes the time to use all the options they now offer. Many people do not. Previous versions of Softaculous had similar problems to Fantastico.

Also, I would highly recommend anyone using Wordpress use iThemes Security to further secure it.

I can't tell you the last time I've seen a Wordpress site hacked simply due to the database prefixes or other settings Softaculous or Fantastico have. The problem here is that these are installation tools, NOT security tools. Securing your sites is not something they're responsible for.

How does changing the database prefix, using weak or even strong passwords protect against someone who blindly installs every junk theme or plugin under the sun?

The problems aren't with the installers, they do what they're supposed to do: install the software. While you can most of the time change all of these settings, they do absolutely nothing against a poorly coded plugin/theme or any other script.

Another issue is you have people that start changing file permissions because they get an error - there's another door to upload shells.

Not changing the temporary password when the hosting account is created - another door into the account.

Not using strong passwords - another door into the account.

Using the same passwords across multiple accounts - another door into the account.

Emailing passwords back and forth in emails - another door into the account.

The biggest door of all - junk plugins & themes.

These installers are hardly root of the problem.

//

You shouldn't be reliant upon the installer to install updates for your sites. Some have the feature, but again, you shouldn't be reliant upon it.

Change all the prefixes & database usernames/passwords you want - the first exploited plugin that allows an attacker to upload any scripts, all of that database stuff becomes irrelevant because they now have access through another vector which is much more common that trying to brute force their way into the database.

I prefer the quick install. It's easier then ever now. My guess it's an outdated software and Hostgator are looking out for there customers and user experience. Have you asked them directly? I know they take feedback seriously.

Fantastico is very old and most providers I have seen are no longer using it, most hosting provider are using either Softaculous.